Executive Summary
A significant increase in Microsoft Teams-based vishing has been observed, where attackers employ a multi-stage social engineering tactic previously associated with Black Basta. The campaign begins with email bombing to overwhelm the target, followed by a fraudulent Teams call from an 'IT support' persona. While the initial access mirrors Black Basta tradecraft, technical analysis of the resulting implant and infrastructure shows significant overlap with Aur0ra activity.
The attack chain involves social engineering victims into installing legitimate remote access tools like AnyDesk to facilitate the delivery of a malicious batch script. This script drops a sideloading chain that leverages a signed Microsoft binary to execute an Xray-core implant. This activity highlights a broadening of high-volume social engineering tactics across different threat groups, aimed at bypassing traditional perimeter defenses through direct victim interaction.
This threat is particularly potent due to its use of legitimate software and signed binaries, which often evade automated detection. Organizations should be aware that the successful execution of this playbook often leads to ransomware deployment if not contained during the initial access or persistence phases.